The present disclosure relates to hard-drive-capacity detection devices, and more specifically to a bridge device that is configured to connect to a stand-alone hard drive, such as a disk hard drive, not resident in a stand-alone computer or which may be used to connect such an external hard drive to a host computer via a non-native bus, and which detects reduced accessible capacity in the external drive.
Host-computer-based programs that allow a user to detect and/or modify a Host Protected Area (“HPA”) or a Device Configuration Overlay (“DCO”) table on the host-computer native or resident hard drive are known. These programs allow a user to effectively reduce the accessible capacity of the hard drive. The accessible capacity of a hard drive, which also may be referred to as the native capacity, is that portion of the full capacity of the hard drive (i.e., the factory default capacity of the hard drive) that is accessible to an operating system of the host computer in which the hard drive is resident or to which the hard drive may be connected. After the program(s) is/are executed to modify the HPA or DCO, the host-computer operating system cannot access a portion of the memory space in the hard drive. That portion of the hard drive is effectively “hidden” from the operating system.
Before the program is executed to reduce the available accessible capacity on the hard drive, data may be written to the area of the hard drive that is rendered inaccessible by the program. Data written to the inaccessible portion of the hard drive is also hidden from the operating system. Although the data is hidden from the operating system, it is still stored on the hard drive.
Software programs that are able to detect HPA and/or DCO reduced accessible capacity are known in the art. However, known software programs designed to detect HPA and/or DCO reduced accessible capacity are resident and executed on a host computer and do not work with all hard drives. Examples of native buses include Integrated Device Electronics (IDE) or Serial AT Attachment (SATA) bus. External hard drives connected to the host computer via non-native buses are problematic for current detection programs. For example, known software programs cannot detect reduced accessible capacity when the external hard drive is connected to the host computer via a Universal Serial Bus (USB) or IEEE 1393—FireWire™. Thus, many external hard drives must be internally mounted to the host computer via the native buses in order for known detection programs to function properly, which is often time-consuming and inefficient.
Detection of HPA and/or DCO reduced accessible capacity in hard drives may be important during computer forensic investigation. For example, data that is important to an investigation may be stored on the portion of the hard drive that cannot be accessed by the operating system due to HPA and/or DCO reduced accessible capacity. When an image of the hard drive is taken for analysis, the data stored on the inaccessible portion of the hard drive may not be captured in the image. Thus, to perform a complete and effective forensic analysis of the hard drive, it may be useful for the investigator to be able to know if there is HPA and/or DCO reduced hard-drive capacity.